OSI Model & Transport Fundamentals — Network+

The OSI model divides network communication into seven layers: Physical (1), Data Link (2), Network (3), Transport (4), Session (5), Presentation (6), and Application (7). Travelling down the stack, each layer wraps the unit above it in its own header — encapsulation — which the receiving side strips off on the way up. On the N10-009 exam, the key confusion is OSI versus the TCP/IP model, which collapses these seven layers into four. Troubleshooting questions ask which layer a device works at: switches at Layer 2, routers at Layer 3, TCP/UDP at Layer 4. TLS encryption maps to Layer 6, not Layer 7.

TCP (Transmission Control Protocol) is a connection-oriented Layer 4 protocol that establishes a session via a three-way handshake before data transfer and tracks every segment to guarantee reliable, ordered delivery. It uses sequence and acknowledgment numbers to detect lost segments and retransmit them, plus flow-control mechanisms like windowing to prevent receiver overload. Common TCP-based services include HTTP (80), HTTPS (443), FTP (21), SSH (22), and SMTP (25). The key exam contrast is UDP: TCP adds reliability at the cost of latency and overhead, while UDP trades delivery guarantees for speed. DNS normally uses UDP but switches to TCP for zone transfers and large responses.

User Datagram Protocol operates at Layer 4 of the OSI model and sends datagrams with no connection setup, handshake, or ordered-delivery tracking. This makes it faster than TCP — no three-way handshake, no acknowledgments, no retransmission of lost segments. For the N10-009 exam, UDP suits traffic where a dropped packet beats a delayed one: DNS queries (port 53), DHCP (ports 67/68), TFTP (port 69), SNMP (port 161), and real-time media like VoIP and streaming. A common trap is assuming DNS always uses TCP; UDP is the default, while TCP handles responses over 512 bytes and zone transfers.

The TCP three-way handshake establishes a reliable, connection-oriented session before data is exchanged. The initiating host sends a SYN carrying its initial sequence number (ISN); the receiver replies with a SYN-ACK acknowledging that ISN and carrying its own; the initiator finishes with a final ACK. Only then does the connection enter the ESTABLISHED state and data transfer begin. A common exam trap is confusing setup with teardown, which uses a four-step FIN/ACK/FIN/ACK exchange rather than three. The handshake is exclusive to TCP; UDP is connectionless and performs no handshake, making it faster but unreliable.

An IP address is a logical Layer 3 identifier assigned to a network interface so routers can forward packets across different networks. IPv4 uses dotted-decimal notation across four octets (e.g., 192.168.1.10), while IPv6 uses eight groups of hexadecimal values separated by colons. Unlike MAC addresses, which are hardware-burned and meaningful only within a local segment, IP addresses are software-assigned and can change. For N10-009, a common trap is confusing the network portion with the host portion — that boundary is set by the subnet mask, not the address itself. A duplicate IP or misconfigured mask causes failures that mimic a hardware fault.

IPv6 uses 128-bit addresses written as eight groups of four hexadecimal digits separated by colons, giving an address space so large it removes the need for NAT. An interface can hold several address types at once: a link-local address (fe80::/10) auto-assigned at startup for on-segment traffic like neighbor discovery, plus a routable global unicast address (2000::/3). Stateless Address Autoconfiguration (SLAAC) lets a host build its own global address from the router-advertised prefix and interface identifier, with no DHCP server needed. On the N10-009 exam, remember that routers never forward link-local addresses off the segment.

Address Resolution Protocol operates at the boundary between Layer 3 (network) and Layer 2 (data link). When a host sends a packet to an IP on the same subnet, it broadcasts an ARP request asking “who has this IP?” The owner replies with its MAC address, and the sender caches the mapping in its ARP table. A key exam nuance is Proxy ARP: a router responds to ARP requests on behalf of hosts on a different subnet, making remote hosts appear local. Gratuitous ARP — a device announcing its own IP-to-MAC mapping unprompted — is used after IP changes but is also exploited in ARP spoofing/poisoning attacks to redirect traffic.

A MAC address is a 48-bit identifier assigned to a network interface card, written as six hexadecimal pairs (e.g., 00:1A:2B:3C:4D:5E). The first three bytes form the Organizationally Unique Identifier (OUI), which identifies the manufacturer. Switches learn MAC addresses by reading source addresses on incoming frames and store them in a MAC address table to forward frames only to the correct port. The critical exam contrast is that MAC addresses operate at Layer 2 for local delivery within a broadcast domain, while IP addresses at Layer 3 handle end-to-end routing. ARP bridges the two by resolving an IP address to a MAC address before a frame can be sent. Although burned into hardware at manufacture, MAC addresses can be spoofed in software — a security nuance N10-009 tests.